🔒 Righto

Righto Privacy Policy

Effective date: 13 October 2026

Righto is an AI governance tool that an organisation deploys onto the Macs it manages. This policy explains what Righto looks at, what it deliberately does not look at, and who is responsible for the data involved. The short version: Righto records metadata about which AI tools are used — not the contents of your files, prompts or code.
Righto is in development. This policy describes how Righto is designed to handle data. Some operational details — where data is stored, exactly how long it is kept, and which sub-processors are involved — depend on final architecture decisions and are marked below as "to be confirmed before launch". We will publish the completed policy, and a data processing agreement for customers, before Righto becomes generally available. We would rather leave these blank than guess.

Who is responsible

Controller and processor

Righto is bought and deployed by an organisation — your employer — onto Macs that the organisation owns or manages. That organisation decides to use Righto, configures it, and decides what to do with what it reports.

Under the UK GDPR, that means the organisation is the data controller for information Righto processes about its employees, and Dhaataa Ltd. acts as a processor on the organisation's instructions. Dhaataa Ltd. is a company registered in the United Kingdom and is the controller only for its own business records, such as the customer's billing and support contacts — those are covered by our company privacy policy.

If you are an employee with a question about why Righto is on your work Mac, or what your employer does with what it reports, your employer is the right place to ask. We will always help them answer you.

Devices

Organisation-managed Macs only

Righto is distributed only through Apple mobile device management (MDM). It is installed by an organisation onto Macs enrolled in that organisation's own MDM — Jamf, Kandji / Iru, Mosyle, Microsoft Intune, Addigy or another Apple MDM.

Righto is not offered to consumers, is not distributed on the Mac App Store for personal use, and is not designed or licensed for installation on personal or unmanaged Macs. There is no way for an individual to install Righto on a device that an organisation does not manage.

Righto is designed to use Apple's Endpoint Security framework and other macOS APIs intended for security software on managed devices, which require both the organisation's MDM approval and Apple-granted entitlements to function.

What it looks at

What Righto collects

Righto's purpose is to show an organisation which AI tools are in use on its Macs, to offer guidance at the point of use, and to produce evidence of that activity. To do that it collects metadata of the following kinds:

AI tool inventory Which AI applications, coding agents, local models, MCP servers and browser extensions are present and in use on the Mac, including names, versions and publishers.
Usage events That an AI tool was launched or used, and when. Enough to show patterns of use and to trigger guidance at the right moment.
Device and user identifiers from your MDM The device identifier, device name and the user account the organisation has associated with that Mac, so the organisation can act on what it sees. These come from the organisation's own MDM records.
Coaching and lesson records That guidance was shown, and whether a short lesson was completed. This is what makes AI literacy evidence possible.

What it does not look at

What Righto does not collect

These are design boundaries, not settings an administrator can quietly switch off:

Not the contents of your work Righto does not collect the contents of documents, files, source code, or the prompts and responses exchanged with an AI tool. It records that a tool was used, not what you said to it.
No keystroke logging or screen recording Righto does not log keystrokes, capture your screen, record audio or video, or take screenshots.
No general web or message monitoring Righto is not a web filter or a communications monitor. It is scoped to AI tool use, not to everything you do on the Mac.
No personal-device or off-hours surveillance Righto only runs on organisation-managed Macs, and collects nothing from any other device you own.

Collecting metadata rather than content is the default and the design intent. If a future version offers an organisation any option that goes beyond metadata, it will be clearly disclosed here, off by default, and visible to the people on the device before it is turned on.

Transparency

What employees can see

Righto is built on the view that governance works better when it isn't a secret. People working on a Mac with Righto installed can see what Righto collects about that Mac, directly on the device.

Separately, macOS itself requires that system extensions and management profiles are visible to the user in System Settings, and that an MDM-enrolled device is identifiable as managed. Righto does not attempt to hide itself, and could not do so.

Purpose

What the data is used for

Righto provides evidence and helps an organisation put measures in place. It does not, by itself, make an organisation compliant with any law or standard — those obligations remain the organisation's own. We do not use customer fleet data to train AI models.

To be confirmed

Storage, retention and sub-processors

These depend on final architecture decisions and will be completed before Righto is generally available:

  • Where Righto data is stored, and in which region
  • How long each category of data is retained, and the deletion process at end of contract
  • The list of sub-processors, with their roles and locations
  • International transfer safeguards for any transfer outside the UK
  • The customer-facing data processing agreement and security documentation

Your rights

Data subject rights

If you are an employee of an organisation using Righto, your rights under the UK GDPR — access, rectification, erasure, restriction, objection and portability — are exercised against your employer, as the controller of that data. Ask your employer, who will usually route the request through their IT or HR team.

As a processor, we will assist our customers in responding to those requests. If you contact us directly about data on a managed Mac, we will refer you to the organisation that manages it, because we are not permitted to act on that data without their instruction.

For personal data we hold as a controller — our own customer and enquiry records — see our company privacy policy, which also explains how to complain to the Information Commissioner's Office.

Updates

Changes to this policy

Righto is in active development, so this policy will change as the product does. We will update the effective date at the top of this page, and will notify customers of material changes. The completed policy will be published before general availability.

Contact

Get in touch

Questions about how Righto handles data, or want to see the documentation as it's finished?

✉️ hello@dhaataa.com